Security debugging method, chip and electronic device

Abstract

The application relates to the chip technical field and discloses a secure debugging method, a chip and an electronic device. The secure debugging method comprises the following steps: a chip can receive a first chip debugging request from a first device, and performs security authentication on the first device initiating the first chip debugging request. If the authentication is passed, and the chip determines that the first device has a debugging permission of debugging a first resource module and does not have a debugging permission of debugging a second resource module based on a first qualification certificate adopted in the authentication, the chip can allow the first device to debug the first resource module and reject the first device to debug the second resource module. In this way, when an engineer of a certain manufacturer debugs the chip, the engineer can only access or modify the chip resources owned by the manufacturer, and cannot obtain the chip resources unique to other manufacturers, which is beneficial to the confidentiality of the chip resources of other manufacturers.

Description

Technical Field

[0001] This application relates to the field of chip technology, and in particular to a secure debugging method, chip, and electronic device. Background Technology

[0002] Currently, chips in devices such as mobile phones, including system-on-chips (SoCs), can have dedicated interfaces (called debug ports or debug access ports) for chip development, testing, and debugging. When the debug port is open, users can access and modify resources (such as data) within the chip. When the debug port is closed, users cannot access these resources. Thus, disabling the debug port at the factory prevents unauthorized individuals from tampering with chip data through it.

[0003] However, when a chip is jointly owned by multiple manufacturers, an engineer from one manufacturer can access all resources within the chip (such as data in memory and the image processor) by opening a debug port, which is detrimental to the confidentiality of core data from other manufacturers. For example, if a chip is jointly owned by a device manufacturer (such as a mobile phone or computer) and a chip supplier, when an engineer from the device manufacturer opens a debug port to debug the image processor within the chip, that engineer can also access the underlying data written into the chip by the chip supplier through the debug port, which is detrimental to the confidentiality of the chip supplier's core data. Summary of the Invention

[0004] This application provides a secure debugging method, chip, and electronic device that enables a manufacturer to access only its own chip resources when debugging chip data, which is beneficial for protecting the chip resources of other manufacturers.

[0005] In a first aspect, this application provides a secure debugging method applied to a chip, the chip including M resource modules, where M is an integer greater than 1. The method includes: receiving a first chip debugging request from a first device; authenticating the first device; and, if the first device is successfully authenticated and, based on the first qualification certificate used in the authentication, it is determined that the first device has debugging permissions for N resource modules out of the M resource modules, but does not have debugging permissions for MN resource modules other than the N resource modules, then the first device is allowed to debug the N resource modules and is denied debugging the MN resource modules, where 1 ≤ N < M and N is an integer.

[0006] In some implementations, different manufacturers can possess different credentials (such as public-private key pairs). When the chip authenticates the first device, the first device can send the chip the first credentials corresponding to the manufacturer that initiated the first chip debugging request, so that the chip can authenticate the first device. Then, after successful authentication, the chip can determine the first user identification information that initiated the first chip debugging request based on the first credentials used during authentication, and thus determine the resource modules that the manufacturer can debug.

[0007] Thus, by using the above method, when a chip is jointly owned by multiple manufacturers, when an engineer from one manufacturer is debugging the chip, that engineer can only access or modify the chip resources owned by their own manufacturer, and cannot obtain the chip resources unique to other manufacturers, which is beneficial for keeping the chip resources of other manufacturers confidential.

[0008] In one possible implementation of the first aspect described above, determining that the first device has debugging permissions for N resource modules out of M resource modules, but not for MN resource modules other than N resource modules, based on the first qualification certificate used for authentication, includes: determining the first user identifier that initiates the first chip debugging request based on the first qualification certificate and a first correspondence relationship, and determining that the first device has debugging permissions for N resource modules but not for MN resource modules based on the first user identifier. The first correspondence relationship includes a one-to-one correspondence between multiple qualification certificates and multiple user identifiers, where the multiple qualification certificates include the first qualification certificate, and the first user identifier is the user identifier among the multiple user identifiers that corresponds to the first qualification certificate.

[0009] In one possible implementation of the first aspect described above, the chip includes a secure debug trust root module, a bus, and R (R is a positive integer less than or equal to M) filter modules, with each of the M resource modules connected to the bus via one of the R filter modules.

[0010] Among them, the first filter module in the R filter modules is connected between the first resource module in the N resource modules and the bus, and the first filter module or the second filter module in the R filter modules is connected between the second resource module in the MN resource modules and the bus.

[0011] Furthermore, based on the first qualification certificate and the first correspondence, a first user identifier initiating the first chip debugging request is determined. Based on the first user identifier, it is determined that the first device has debugging permissions for N resource modules but not for MN resource modules. This includes: the secure debugging trust root module determining the first user identifier based on the first qualification certificate and the first correspondence, and sending a first signal identifier indicating the first user identifier to R filter modules. The first filter module among the R filter modules, connecting the first resource module to the bus, determines based on the first signal identifier that the first device has debugging permissions for the first resource module and allows the first device to debug the first resource module. The first filter module or the second filter module among the R filter modules, connecting the second resource module to the bus, determines based on the first signal identifier that the first device does not have debugging permissions for the second resource module and refuses the first device's debugging of the second resource module.

[0012] In one possible implementation of the first aspect above, the first filter module, which connects the first resource module and the bus among the R filter modules, determines that the first device has debugging permission to debug the first resource module based on the first signal identifier, including: if the first filter module has a signal identifier identical to the first signal identifier in the second signal identifier stored in the first filter module, the first filter module determines that the first device has debugging permission to debug the first resource module, wherein the second signal identifier includes one or more signal identifiers that have debugging permission to debug the first resource module.

[0013] The first filter module or the second filter module, which connects the second resource module and the bus among the aforementioned R filter modules, determines that the first device does not have debugging permission to debug the second resource module based on the first signal identifier. This includes: if the second filter module (or the first filter module) does not have a signal identifier identical to the first signal identifier in the third signal identifier stored in the second filter module (or the first filter module), it determines that the first device does not have debugging permission to debug the second resource module. The third signal identifier includes one or more signal identifiers that have debugging permission to debug the second resource module.

[0014] In this way, the resource modules that the first device that initiated the first debugging request can and cannot debug can be determined, and the first device can be allowed to debug only the resource modules that it has debugging permission.

[0015] In one possible implementation of the first aspect described above, the chip includes a secure debug root trust module, a debug port, a bus, and a third filter module connected between the debug port and the bus.

[0016] Furthermore, the aforementioned process of determining the first user identifier for initiating the first chip debugging request based on the first qualification certificate and the first correspondence, and determining that the first device has debugging permissions for N resource modules but not for MN resource modules based on the first user identifier, includes: the secure debugging trust root module determining the first user identifier based on the first qualification certificate and the first correspondence, and sending a first signal identifier indicating the first user identifier to the third filter module. The third filter module, based on the first signal identifier, determines that the first device has debugging permissions for the first resource module among the N resource modules, but not for the second resource module among the MN resource modules, allowing the first device to debug the first resource module, and denying the first device from debugging the second resource module.

[0017] In one possible implementation of the first aspect described above, the third filter module determines, based on the first signal identifier, that the first device has the debugging permission to debug the first resource module among N resource modules, but does not have the debugging permission to debug the second resource module among MN resource modules. This includes: if the first module identifier group corresponding to the first signal identifier in the second correspondence includes the module identifier of the first resource module but does not include the module identifier of the second resource module, the third filter module determines that the first device has the debugging permission to debug the first resource module but does not have the debugging permission to debug the second resource module. The second correspondence includes a correspondence between multiple signal identifiers and multiple module identifier groups. Each module identifier group includes the module identifier of at least one resource module for which the corresponding signal identifier has debugging permission. The multiple signal identifiers include the first signal identifier, and the first module identifier group is the module identifier group corresponding to the first signal identifier among the multiple module identifier groups. Alternatively, if the third filter module has a signal identifier in the fourth signal identifier that is the same as the first signal identifier, and there is no signal identifier in the fifth signal identifier that is the same as the first signal identifier, it determines that the first device has the debugging permission to debug the first resource module, but does not have the debugging permission to debug the second resource module. Here, the fourth signal identifier includes one or more signal identifiers that have the debugging permission to debug the first resource module, and the fifth signal identifier includes one or more signal identifiers that have the debugging permission to debug the second resource module.

[0018] In this way, the resource modules that the first device that initiated the first debugging request can and cannot debug can be determined, and the first device can be allowed to debug only the resource modules that it has debugging permission.

[0019] In one possible implementation of the first aspect above, the M resource modules include a central processing unit, and the chip includes a secure debug root trust module, a debug port, a bus, a fourth filter module, and a fifth filter module. The fourth filter module is connected to M-1 resource modules other than the central processing unit among the M resource modules via the bus. The fourth filter module is also connected to the debug port, and the fifth filter module is connected between the debug port and the central processing unit.

[0020] Furthermore, when the first resource module among the N resource modules is a central processing unit, the aforementioned determination of the first user identifier initiating the first chip debugging request based on the first qualification certificate and the first correspondence, and the determination of whether the first device has debugging permissions for the N resource modules but not for the MN resource modules based on the first user identifier, includes: the secure debugging trust root module determining the first user identifier based on the first qualification certificate and the first correspondence, and sending a first signal identifier indicating the first user identifier to the fourth filter module and the fifth filter module. The fifth filter module determines that the first device has debugging permissions for the first resource module based on the first signal identifier, and allows the first device to debug the first resource module; the fourth filter module determines that the first device does not have debugging permissions for the second resource module among the MN resource modules based on the first signal identifier, and refuses the first device to debug the second resource module.

[0021] Thus, by using the above method, the chip can also determine whether the first device has debugging privileges for debugging the central processing unit (CPU), so as to refuse debugging operations on the CPU if the device does not have the privileges to debug the CPU.

[0022] In one possible implementation of the first aspect described above, allowing the first device to debug the first resource module includes: establishing a communication path between the chip's debug port and the first resource module, or allowing data transmission between the debug port and the first resource module. Denying the first device from debugging the second resource module includes: disconnecting the communication path between the chip's debug port and the second resource module, or intercepting data transmission between the debug port and the second resource module.

[0023] Thus, by using the above method, when the chip determines that the first device has the debugging permission to debug the first resource module and does not have the debugging permission to debug the second resource module, the chip can allow the first device to debug the first resource module and refuse the first device to debug the second resource module.

[0024] In one possible implementation of the first aspect above, the M resource modules include one or more of the following resource modules: central processing unit, neural network processor, graphics processor, audio processor, microprocessor, memory, controller, baseband processor, sensor hub, tensor processing unit, vision processing unit, etc.

[0025] Secondly, this application provides a chip, including: a secure debugging trust root module, M resource modules, R filter modules, and a bus. Each of the M resource modules is connected to the bus via one of the R filter modules. Specifically, a first filter module among the R filter modules is connected between the first resource module among the M resource modules and the bus, and a second filter module among the R filter modules is connected between the second resource module among the M resource modules and the bus; M is an integer greater than 1, and R is a positive integer less than or equal to M.

[0026] The secure debugging trust root module is configured to receive a first chip debugging request from a first device and perform security authentication on the first device; and, if the authentication of the first device is successful, to determine the first user identifier that initiated the first chip debugging request based on the first qualification certificate used for authentication and a first correspondence, and to send a first signal identifier indicating the first user identifier to R filter modules. The first correspondence includes a one-to-one correspondence between multiple qualification certificates and multiple user identifiers, where the multiple qualification certificates include the first qualification certificate, and the first user identifier is the user identifier among the multiple user identifiers that corresponds to the first qualification certificate.

[0027] The first filter module, which connects the first resource module to the bus among the R filter modules, is used to determine that the first device has debugging permission to debug the first resource module when there is a signal identifier in the second signal identifier stored in the first filter module that is the same as the first signal identifier, and to allow the first device to debug the first resource module. The second signal identifier includes one or more signal identifiers that have debugging permission for the first resource module.

[0028] The first filter module or the second filter module, which connects the second resource module to the bus among the R filter modules, is used to determine that the first device does not have debugging permission to debug the second resource module if there is no signal identifier identical to the first signal identifier in the third signal identifier stored in the first filter module or the second filter module, and to refuse the first device from debugging the second resource module. The third signal identifier includes one or more signal identifiers that have debugging permission for the second resource module.

[0029] Thus, when the chip to be debugged is the aforementioned chip, if the chip is jointly owned by multiple manufacturers and an engineer from one manufacturer debugs the chip using the first device, the engineer can only access or modify the resources of the chip owned by his own manufacturer, and cannot obtain the resources of the chips unique to other manufacturers, which is beneficial for keeping the resources of other manufacturers' chips confidential.

[0030] Thirdly, this application provides a chip including: a secure debugging trust root module, M resource modules, a debugging port, a bus, and a third filter module, wherein the third filter module is connected between the debugging port and the bus, and M is an integer greater than 1.

[0031] The secure debugging trust root module is configured to receive a first chip debugging request from a first device and perform security authentication on the first device; and, if the authentication of the first device is successful, to determine the first user identifier that initiated the first chip debugging request based on the first qualification certificate used for authentication and a first correspondence, and to send a first signal identifier indicating the first user identifier to the third filter module. The first correspondence includes a one-to-one correspondence between multiple qualification certificates and multiple user identifiers, where the multiple qualification certificates include the first qualification certificate, and the first user identifier is the user identifier among the multiple user identifiers that corresponds to the first qualification certificate.

[0032] The third filter module is used to determine, in the case that the first module identifier group corresponding to the first signal identifier in the second correspondence relationship includes the module identifier of the first resource module but does not include the module identifier of the second resource module, that the first device has the debugging permission to debug the first resource module but does not have the debugging permission to debug the second resource module. Furthermore, the third filter module is also used to allow the first device to debug the first resource module and deny the first device to debug the second resource module. The second correspondence relationship includes a correspondence between multiple signal identifiers and multiple module identifier groups. Each module identifier group includes the module identifier of at least one resource module for which the corresponding signal identifier has debugging permission. The multiple signal identifiers include the first signal identifier, and the first module identifier group is the module identifier group corresponding to the first signal identifier among the multiple module identifier groups.

[0033] Alternatively, the third filter module is further configured to determine that the first device has the debugging permission to debug the first resource module but does not have the debugging permission to debug the second resource module when there is a signal identifier identical to the first signal identifier in the fourth signal identifier and no signal identifier identical to the first signal identifier in the fifth signal identifier. Furthermore, the third filter module is further configured to allow the first device to debug the first resource module and refuse the first device to debug the second resource module, wherein the fourth signal identifier includes one or more signal identifiers having the debugging permission to debug the first resource module, and the fifth signal identifier includes one or more signal identifiers having the debugging permission to debug the second resource module.

[0034] Thus, when the chip to be debugged is the aforementioned chip, if the chip is jointly owned by multiple manufacturers and an engineer from one manufacturer debugs the chip using the first device, the engineer can only access or modify the resources of the chip owned by his own manufacturer, and cannot obtain the resources of the chips unique to other manufacturers, which is beneficial for keeping the resources of other manufacturers' chips confidential.

[0035] Fourthly, this application provides a chip including: a secure debugging root trust module, M resource modules, a debug port, a bus, a fourth filter module, and a fifth filter module. The M resource modules include a central processing unit and a second resource module. The fourth filter module is connected to M-1 resource modules (excluding the central processing unit) of the M resource modules via the bus. The fourth filter module is also connected to the debug port. The fifth filter module is connected between the debug port and the central processing unit. M is an integer greater than 1.

[0036] The secure debugging trust root module is configured to receive a first chip debugging request from a first device and perform security authentication on the first device; and, if the authentication of the first device is successful, to determine the first user identifier that initiated the first chip debugging request based on the first qualification certificate used for authentication and a first correspondence, and to send a first signal identifier indicating the first user identifier to the fourth filter module and the fifth filter module. The first correspondence includes a one-to-one correspondence between multiple qualification certificates and multiple user identifiers, where the multiple qualification certificates include the first qualification certificate, and the first user identifier is the user identifier among the multiple user identifiers that corresponds to the first qualification certificate.

[0037] The fourth filter module is used to determine, based on the first signal identifier, that the first device does not have the debugging permission to debug the second resource module, and to refuse the first device from debugging the second resource module.

[0038] The fifth filter module is used to determine, based on the first signal identifier, that the first device has debugging authority to debug the central processing unit, and to allow the first device to debug the central processing unit.

[0039] Thus, when the chip to be debugged is the aforementioned chip, if the chip is jointly owned by multiple manufacturers and an engineer from one manufacturer debugs the chip using the first device, the engineer can only access or modify the resources of the chip owned by his own manufacturer, and cannot obtain the resources of the chips unique to other manufacturers, which is beneficial for keeping the resources of other manufacturers' chips confidential.

[0040] Fifthly, this application provides an electronic device including the chip mentioned in the second, third, or fourth aspects.

[0041] In a sixth aspect, this application provides an electronic device, including a chip, which is used to implement the secure debugging method mentioned in the first aspect of this application or any possible implementation thereof through logic circuits or execution instructions. Attached Figure Description

[0042] Figure 1 According to some embodiments, a schematic diagram of debugging a chip is shown;

[0043] Figure 2 According to some embodiments of this application, a flowchart of a secure debugging method is shown;

[0044] Figure 3 According to some embodiments of this application, a schematic diagram of a chip structure is shown;

[0045] Figure 4 According to some embodiments of this application, a schematic diagram of another chip structure is shown;

[0046] Figure 5 According to some embodiments of this application, a schematic diagram of the structure of yet another chip is shown;

[0047] Figure 6 According to some embodiments of this application, a schematic diagram of the structure of an electronic device is shown. Detailed Implementation

[0048] The illustrative embodiments of this application include, but are not limited to, secure debugging methods, chips, and electronic devices.

[0049] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions in the embodiments of this application will be described in detail below with reference to the accompanying drawings and specific implementation methods.

[0050] The illustrative embodiments of this application include, but are not limited to, secure debugging methods, devices, storage media, and program products.

[0051] To make the objectives, embodiments, and advantages of this application clearer, the implementation methods of this application will be described in further detail below.

[0052] It should be noted that the chip mentioned in this application may include at least two resource modules, such as, but not limited to, a central processing unit (CPU), a neural processing unit (NPU), a graphics processing unit (GPU), an audio processing unit (APU), a video processing unit (VPU), a microprocessor (MPU), a controller, or a memory, etc.

[0053] As described in the background section, the device's chip can be equipped with a debug port for chip development, testing, and debugging. When the debug port is open, the user can access and modify resources within the chip. The following section will combine... Figure 1 As shown, an exemplary description is provided of the process of debugging a chip by opening a debug port.

[0054] For example, such as Figure 1 As shown, engineers can use debugging equipment 100 (such as a computer) to debug chip 200. Chip 200 can be mounted on a circuit board or other electronic device, and debugging equipment 100 can communicate with the device where chip 200 is located (such as a circuit board or other electronic device). Debugging equipment 100 can also communicate with cloud 300 (e.g., cloud 300 may have a secure debug service (Sec Dbg Srv) deployed on it).

[0055] like Figure 1 As shown, chip 200 may include a secure debug root-of-trust (Sec Dbg RoT) module 201 and a debug port 202. The secure debug root-of-trust module 201 on chip 200 (such as the secure debug agent firmware) can communicate with the debug device 100. For example, it can report debug requests to the secure debug root-of-trust module 201 through an implementation-defined channel (IMPL-DEF Channel).

[0056] refer to Figure 1As shown, during the debugging process of chip 200, debugging device 100 can initiate a debugging request to the secure debugging signal root module 201 on chip 200. Upon receiving the debugging request, the secure debugging trust root module 201 can perform security authentication on debugging device 100. For example, the secure debugging trust root module 201 can generate a challenge value and send it to debugging device 100. Debugging device 100 can then send the challenge value and relevant information about the manufacturer initiating the debugging request to cloud 300, so that cloud 300 can sign the challenge value and return the signature. Debugging device 100 can then report the signature and qualification certificate to secure debugging trust root module 201. Secure debugging trust root module 201 can verify the validity of the received signature using the received qualification certificate; if valid, security authentication is successful; if invalid, authentication fails.

[0057] In the event of authentication failure, debug port 202 can remain closed. Conversely, upon successful authentication, the secure debug root module 201 can open debug port 202, allowing debug device 100 to access data within chip 200 via debug port 202. A data bus (also known as a debug channel) connects debug port 202 to various resource modules of the chip (such as memory and image processor). After the secure debug root module 201 opens debug port 202, debug device 100 can access various resource modules within chip 200 via debug port 202 and the data bus.

[0058] For example, a chip can be jointly owned by multiple manufacturers. Different resource modules within the chip (such as different intellectual property (IP) cores like NPU, GPU, or APU) can be designed by different manufacturers. However, if an engineer from one manufacturer can access data in all resource modules of the chip when opening a debug port, such as data in resource modules designed by other manufacturers, it is detrimental to the confidentiality of other manufacturers' core data. For example, see reference... Figure 1 As shown, if chip 200 is jointly owned by the car manufacturer and the chip supplier, after the car manufacturer's engineer opens the debug port 202, the engineer can access all resource modules in chip 200 through the debug port 202 and the data bus. For example, the engineer can access the chip supplier's unique resource modules, which is not conducive to the confidentiality of the chip supplier's core data.

[0059] To address the aforementioned issues, this application provides a secure debugging method. Specifically, the method includes: a chip receiving a first chip debugging request from a first device and performing security authentication on the first device initiating the first chip debugging request. Wherein, if authentication is successful, and the chip determines, based on the first qualification certificate used in the authentication, that the first device has debugging permissions for N resource modules out of the chip's M resource modules but not for the other MN resource modules, then the chip can allow the first device to debug the N debuggable resource modules and refuse the first device to debug the MN undebuggable resource modules. Here, M is an integer greater than 1, 1 ≤ N < M, and N is an integer.

[0060] In some embodiments, different manufacturers may possess different credentials (such as public-private key pairs). The chip can determine the information of the manufacturer initiating the chip debugging request based on the credentials used during authentication, and thus determine the resource modules that the manufacturer can debug. For example, when a first manufacturer debugs the chip through a first device, the chip can perform security authentication on the first device that initiated the first chip debugging request. For example, the chip can generate a challenge value based on the chip UID and a random number, and send the challenge value to the first device. Then, the first device can send the challenge value and the first credentials to the cloud, so that the security debugging service deployed in the cloud can sign the challenge value and return a signature. The first device can then send the signature and the first credentials of the first manufacturer to the chip so that the chip can verify whether the signature is valid. If it is valid, the security authentication is successful; if it is invalid, the authentication fails. Furthermore, after successful authentication, the chip can also determine the first user identifier of the first manufacturer that initiated the first chip debugging request through the first device based on the first credentials, and thus determine the resource modules that the first manufacturer can debug.

[0061] In some embodiments, the chip may store information about the resource modules that each manufacturer can debug. Then, after the chip determines the manufacturer that initiated the chip debugging request based on the qualification certificate used during authentication, it can determine the resource modules that the manufacturer can debug based on the stored information.

[0062] In some embodiments, if the first device has debugging permission for the first resource module among N resource modules, a communication path can be established between the chip debug port and the first resource module. For example, a first filter module can be connected between the bus and the first resource module. Debug data sent by the first device can be transmitted sequentially to the first filter module via the debug port and the bus. If the first device has debugging permission for the first resource module, the first filter module can act as a communication path to transmit debug data to the first resource module. Furthermore, data in the first resource module can also be transmitted to the first filter module, and then transmitted by the first filter module to the debug port via the bus, so as to be transmitted to the first device. Alternatively, if the first device has debugging permission for the first resource module, data transmission between the debug port and the first resource module can also be allowed. For example, a third filter module can be connected between the debug port and the bus. Debug data sent by the first device can be transmitted to the third filter module via the debug port. If the first device has debugging permission for the first resource module, the third filter module can transmit debug data to the first resource module via the bus connected to the first resource module. Furthermore, the data in the first resource module can also be transmitted to the third filter module via the bus, and then transmitted from the third filter module to the debugging port, so as to the first device.

[0063] It should be noted that the filter module mentioned in this application can filter the received data, allowing only data that meets the requirements to pass through. That is, the filter module mentioned in this application can only transmit data that meets the requirements to the connected module, while data that does not meet the requirements will not be transmitted to the connected module. For example, when the first device is allowed to access the first resource module, the first filter module can transmit the debugging data of the first device to the first resource module; when the first device is not allowed to access the second resource module, the second filter module will not transmit the debugging data of the first device to the second resource module. Exemplarily, the filter module mentioned in this application can be a logic circuit used to implement the method mentioned in this application.

[0064] In other embodiments, if the first device does not have debugging permission for the second resource module among the MN resource modules, the communication path between the chip's debug port and the second resource module can be disconnected. For example, a second filter module (or a first filter module) can be connected between the bus and the second resource module. Debug data sent by the first device can be transmitted sequentially to the second filter module (or the first filter module) via the debug port and the bus. If the first device has debugging permission for the second resource module, the second filter module (or the first filter module) can prevent the debug data from being transmitted to the first resource module, thereby disconnecting the communication path between the bus and the second resource module. Alternatively, if the first device does not have debugging permission for the second resource module, data transmission between the debug port and the second resource module can be intercepted. For example, a third filter module can be connected between the debug port and the bus. Debug data sent by the first device can be transmitted to the third filter module via the debug port. If the first device does not have debugging permission for the second resource module, the third filter module can prevent the debug data from being transmitted to the second resource module via the bus.

[0065] Thus, by using the above method, when a chip is jointly owned by multiple manufacturers, when an engineer from one manufacturer is debugging the chip, that engineer can only access or modify the chip resources owned by their own manufacturer, and cannot obtain the chip resources unique to other manufacturers, which is beneficial for keeping the chip resources of other manufacturers confidential.

[0066] It should be noted that the debugging of resource modules in the chip mentioned in this application may refer to one or more debugging operations such as accessing data in the chip's resource modules (e.g., accessing data in registers, caches, and other memories in various resource modules), modifying data in the chip's resource modules (e.g., modifying data in the decoding unit of the central processing unit), deleting data in the chip's resource modules (e.g., deleting certain data in the registers of a certain resource module), or adding data to the chip's resource modules (e.g., adding certain data to the registers of a certain resource module). This application does not limit this.

[0067] The following is based on Figure 2 The flowchart shown provides a brief overview of the secure debugging method mentioned in the embodiments of this application. This secure debugging method can be applied to chips. Figure 2 As shown, specifically, the method is as follows:

[0068] S21: Received the first chip debugging request from the first device.

[0069] In some embodiments, the chip may be mounted on a circuit board or other electronic device. Furthermore, the chip may communicate with a first device; for example, the first device and the device on which the chip resides (such as a circuit board) may have a communication line connection so that the chip can receive a first chip debugging request from the first device.

[0070] For example, the secure debug root of trust module in the chip can be used to receive a first chip debug request.

[0071] In some embodiments, the first device can be any debugging device, such as a desktop computer, a laptop computer, a mobile computer, an industrial control terminal, etc.

[0072] S22: Authenticate the first device.

[0073] In some embodiments, the secure debugging root of trust module in the chip can perform security authentication on the first device that initiated the first chip debugging request after receiving the first chip debugging request. For details of the authentication process, please refer to [reference needed]. Figure 1 As shown, no further details will be provided.

[0074] In some embodiments, when authentication with the first device fails, the chip may keep the debug port closed so that the first device cannot access the resource modules in the chip. In other embodiments, when authentication with the first device succeeds, the chip may execute the following S23 to debug the resource modules in the chip.

[0075] S23: If the first device passes authentication and, based on the first qualification certificate used in the authentication, it is determined that the first device has debugging permissions for N resource modules out of the M resource modules of the chip, but does not have debugging permissions for the remaining MN resource modules out of the M resource modules, then the first device is allowed to debug the N debuggable resource modules, and is prohibited from debugging the MN resource modules that cannot be debugged. Where M is an integer greater than 1, 1 ≤ N < M, and N is an integer.

[0076] In some embodiments, the M resource modules included in the chip may be some or all of the resource modules in the chip. For example, the M resource modules may include, but are not limited to, one or more of the following resource modules: central processing unit, neural network processor, graphics processor, audio processor, microprocessor, memory, controller, baseband processor, sensor hub, tensor processing unit, vision processing unit, etc. A single resource module may also include one or more components or devices. For example, the central processing unit may include multiple devices such as registers, time-to-time gating units, value fetching units, and decoding units. As another example, the one-time programmable memory may be formed from an electronic fuse (eFuse) device.

[0077] In some embodiments, different manufacturers may possess different qualification certificates. The chip can determine the user identifier corresponding to the manufacturer initiating the chip debugging request based on the qualification certificate used during authentication and the stored first correspondence, thereby determining the resource modules that the manufacturer can debug. The first correspondence may include a one-to-one correspondence between multiple qualification certificates and multiple user identifiers.

[0078] For example, when a chip authenticates a first device, the first device can send a first qualification certificate from a first vendor to the chip, requesting a first chip debug request. This allows the chip to complete the authentication process based on the first qualification certificate. After successful authentication of the first device, the chip can determine the first user identifier that initiated the first chip debug request through the first device, based on the received first qualification certificate and a stored first correspondence. For instance, the chip can store a one-to-one correspondence between multiple qualification certificates and multiple user identifiers. These multiple qualification certificates may include the first qualification certificate, and the multiple user identifiers may include the first user identifier corresponding to the first qualification certificate. In this way, the chip can find the first user identifier based on the first qualification certificate.

[0079] Next, after determining the first user identifier based on the first qualification certificate, the chip can determine, based on the first user identifier, that the first device has debugging permissions for N resource modules out of M resource modules, but not for the other MN resource modules out of M resource modules. For example, the chip can store information about the resource modules with corresponding debugging permissions for each user identifier, such as "User identifier A: Can debug resource modules A and B", "User identifier B: Can debug resource modules B and C", etc., so as to determine the debuggable resource modules based on the user identifier. Alternatively, the chip can also store the identifier signals of the manufacturers with debugging permissions allowed for each resource module, such as "Resource module A: Allows user identifier A to debug", "Resource module B: Allows user identifier B to debug", etc., so as to determine the debuggable resource modules based on the user identifier.

[0080] In this way, the resource modules that the first device that initiated the first debugging request can and cannot debug can be determined, and the first device can be allowed to debug only the resource modules that it has debugging permission.

[0081] In some embodiments, each user identifier can also be indicated by a signal identifier in the chip. For example, the first user identifier "×× Manufacturer" can be indicated by the first signal identifier 10.

[0082] In other embodiments, the user identifier and the signal identifier may be the same or different. That is, in the chip, the user identifier can be directly used as the signal identifier corresponding to that user identifier, or a specific signal identifier can be set for each user identifier.

[0083] It is understood that the binary files containing the first correspondence mentioned above, the signal identifiers corresponding to each user identifier, the relevant information of each resource module with corresponding debugging permissions owned by each user identifier (or signal identifier), or the relevant information of user identifiers (or signal identifiers) with debugging permissions allowed by each resource module, can be burned into the chip's one-time programmable memory (OTP) or chip electronic fuse (eFuse), etc.

[0084] It can also be understood that the aforementioned first correspondence, the relevant information of each resource module with corresponding debugging permissions possessed by each user identifier (or signal identifier), or the relevant information of the user identifiers (or signal identifiers) of manufacturers with debugging permissions allowed by each resource module, etc., can be stored through any data structure (such as a list, dictionary, etc.). This application does not limit this.

[0085] In some embodiments, when the chip determines that the first device has debugging permission to debug the first resource module but does not have debugging permission to debug the second resource module, the chip can establish a communication path between the chip's debugging port and the first resource module to allow the first device to debug the first resource module, and the chip can also disconnect the communication path between the chip's debugging port and the second resource module to prevent the first device from debugging the second resource module. The following describes... Figure 3 As shown, the process of allowing the first device to debug the first resource module among N resource modules and denying the first device to debug the second resource module among MN resource modules is described in detail.

[0086] For example, such as Figure 3 As shown, chip 10 may include a secure debugging trust root module 11, a debug port 12, and a bus 13. Furthermore, chip 10 may also include M resource modules, such as a first resource module 141 (e.g., a video processing unit) and a second resource module 142 (e.g., a controller), and R filter modules, such as a first filter module 151 and a second filter module 152 (where R is a positive integer less than or equal to M). Bus 13 may be a bus matrix comprising multiple buses, and each resource module can be connected to a corresponding bus.

[0087] For example, in chip 10, each of the M resource modules can be connected to one of the R filter modules via bus 13. That is, one filter module can be connected to one or more resource modules. For example, in... Figure 3 In this embodiment, the first filter module 151 of the R filter modules can be connected between the first resource module 141 and the bus 13, and the second filter module 152 of the R filter modules can be connected between the second resource module 142 and the bus 13. Alternatively, in some other embodiments, the first filter module 151 can also be connected between the second resource module 142 and the bus 13 (this connection method is not shown in the figure), and this application does not limit this.

[0088] Understandable. Figure 3 The connection method of the modules inside the chip 10 shown is only one example. In other embodiments, the modules inside the chip can be directly connected through buses, signal lines, or connectors. For example, the first filter module 151 can be directly connected to the first resource module 141. Alternatively, the modules inside the chip can be indirectly connected. For example, a buffer (not shown in the figure) or other device can be included between the debug port 12 and the first filter module 151.

[0089] Continue to refer to Figure 3 As shown, the secure debugging trust root module 11 in chip 10 can receive a first chip debugging request from a first device and perform security authentication on the first device. Then, if the authentication of the first device is successful, the secure debugging trust root module 11 can open the debugging port 12. Furthermore, if the authentication of the first device is successful, the secure debugging trust root module 11 can also determine the first user identifier that initiated the first chip debugging request through the first device based on the first qualification certificate and the first correspondence used in the authentication process. For example, the secure debugging trust root module 11 can store the first correspondence, which may include relevant information such as {qualification certificate A: user identifier A; qualification certificate B: user identifier B…}. The secure debugging trust root module 11 can look up the corresponding first user identifier (such as user identifier A) in the first correspondence based on the first qualification certificate (such as qualification certificate A).

[0090] Next, after determining the first user identifier, the security debugging trust root module 11 can send a first signal identifier indicating the first user identifier to R filter modules. The first user identifier and the first signal identifier can be the same or different. For example, the security debugging trust root module 11 can store information such as {User Identifier A: Signal Identifier A; User Identifier B: Signal Identifier B…}. The security debugging trust root module 11 can find the corresponding first signal identifier (such as signal identifier A) based on the first user identifier (e.g., user identifier A) and send it to each of the R filter modules. For example, the security debugging trust root module 11 can transmit the first signal identifier to each filter module via the debugging port 12 and the bus 13.

[0091] For example, after each of the R filter modules receives the first signal identifier, each filter module can determine whether the first device has permission to debug the resource module connected to each filter module based on the first signal identifier, thereby allowing or denying the first device to debug the corresponding resource module.

[0092] For example, taking the first filter module 151 connecting the first resource module 141 and the bus 13 as an example, the first filter module 151 can determine that the first device has debugging permission to debug the first resource module 141 based on the first signal identifier. For example, the first filter module 151 can store a second signal identifier, which may include one or more signal identifiers that have debugging permission for the first resource module 141 (such as storing signal identifiers 01, 11, etc.). In this way, when the first filter module 151 determines that there is a signal identifier in the stored second signal identifiers that is the same as the first signal identifier (such as signal identifier 11), the first filter module 151 can determine that the first device has debugging permission to debug the first resource module 141, thereby allowing the first device to debug the first resource module 141. That is, the first filter module 151 can transmit the debug data received from the first device through the bus 13 to the first resource module 141 or transmit the data from the first resource module 141 to the debug port 12 through the bus 13, so that the first filter module 151 can act as a communication path between the bus 13 and the first resource module 141 (which can be equivalent to a communication path between the debug port 12 and the first resource module 141).

[0093] For example, taking the second filter module 152 connecting the second resource module 142 and the bus 13 as an example, the second filter module 152 can determine that the first device does not have debugging permission to debug the second resource module 142 based on the first signal identifier. For example, the second filter module 152 can store a third signal identifier, which may include one or more signal identifiers that have debugging permission for the second resource module 142 (such as storing signal identifiers 01, 10, 00, etc.). In this way, when the second filter module 152 determines that there is no signal identifier in the stored third signal identifier that is the same as the first signal identifier (such as the first signal identifier 11 is not present), the second filter module 152 can determine that the first device does not have debugging permission to debug the second resource module 142, and thus refuse the first device to debug the second resource module 142. That is, the second filter module 152 can filter and delete the debugging data from the first device, thereby not transmitting the debugging data from the first device to the second resource module 142, and thus disconnecting the communication path between the bus 13 and the second resource module 142 (which can be equivalent to disconnecting the communication path between the debugging port 12 and the first resource module 141).

[0094] Alternatively, in other implementations, if the second resource module 142 is connected to the bus 13 via a first filter module 151 (not shown in the diagram), the first filter module 151 can determine that the first device does not have debugging privileges for the second resource module 142 based on a first signal identifier. For example, the first filter module 151 can store a third signal identifier, which may include one or more signal identifiers that have debugging privileges for the second resource module 142. Thus, when the first filter module 151 determines that there is no signal identifier in the stored third signal identifiers that is identical to the first signal identifier, the first filter module 151 can determine that the first device does not have debugging privileges for the second resource module 142, and therefore refuse the first device's request to debug the second resource module 142.

[0095] Thus, by means of the above method, when the chip 10 determines that the first device has the debugging permission to debug the first resource module 141 and does not have the debugging permission to debug the second resource module 142, the chip 10 can allow the first device to debug the first resource module 141 and refuse the first device to debug the second resource module 142.

[0096] In other embodiments, in addition to the above... Figure 3In addition to the aforementioned debugging process, when the chip determines that the first device has debugging permission for the first resource module but not debugging permission for the second resource module, the chip can also allow data transmission between the chip's debugging port and the first resource module, thereby allowing the first device to debug the first resource module. Furthermore, the chip can also intercept data transmission between the chip's debugging port and the second resource module, thereby preventing the first device from debugging the second resource module. The following is a related analysis. Figure 4 As shown, the process of allowing the first device to debug the first resource module among N resource modules and denying the first device to debug the second resource module among MN resource modules is described.

[0097] For example, such as Figure 4 As shown, chip 20 may include a secure debugging root of trust module 21, a debug port 22, and a bus 23. Furthermore, chip 20 may also include M resource modules, such as a first resource module 241 (e.g., a central processing unit) and a second resource module 242 (e.g., a controller), and chip 20 may also include a third filter module 25. The bus 23 may be a bus matrix comprising multiple buses, and each resource module can be connected to a corresponding bus. The third filter module 25 can be connected between the debug port 22 and the bus 23.

[0098] Understandable. Figure 4 The connection method of the modules inside chip 20 shown is only one example. In other embodiments, the modules inside the chip can be directly connected via buses, signal lines, or connectors. For example, the third filter module 25 can be directly connected to the first resource module 241. Alternatively, the modules inside the chip can be indirectly connected. For example, a buffer (not shown in the figure) can be included between the debug port 22 and the third filter module 25.

[0099] Continue to refer to Figure 4As shown, the secure debugging trust root module 21 in chip 20 can receive a first chip debugging request from a first device and perform security authentication on the first device. Then, if the first device is successfully authenticated, the secure debugging trust root module 21 can open the debugging port 22. Furthermore, if the first device is successfully authenticated, the secure debugging trust root module 21 can also determine the first user identifier that initiated the first chip debugging request through the first device based on the first qualification certificate and the first correspondence used during the authentication process. Then, after determining the first user identifier, the secure debugging trust root module 21 can send a first signal identifier indicating the first user identifier to the third filter module 25. For example, the secure debugging trust root module 21 can transmit the first signal identifier to the third filter module 25 via the debugging port 22. See details for further information. Figure 3 As previously stated, I will not repeat myself.

[0100] For example, such as Figure 4 As shown, when the third filter module 25 receives the first signal identifier, the third filter module 25 can determine the resource module that the first device can debug based on the first signal identifier, and then only transmit the debugging data of the first device to the resource module that can be debugged.

[0101] For example, the third filter module 25 can determine, based on the first signal identifier, that the first device has debugging permission for the first resource module 241 but not debugging permission for the second resource module 242. For example, the third filter module 25 can store a second correspondence, which may include a correspondence between multiple signal identifiers and multiple module identifier groups. Each module identifier group includes the module identifier of at least one resource module for which the corresponding signal identifier has debugging permission. The multiple signal identifiers in the second correspondence include the first signal identifier, and the multiple module identifier groups in the second correspondence include the first module identifier group corresponding to the first signal identifier. For example, information related to the second correspondence, such as {Signal identifier A: Can access resource module 1 and resource module 2; Signal identifier B: Can access resource module 2…}, can be stored. Then, if the first module identifier group corresponding to the first signal identifier in the second correspondence includes the module identifier of the first resource module 241 but does not include the module identifier of the second resource module 242, the third filter module 25 can determine that the first device has debugging permission for the first resource module 241 but not debugging permission for the second resource module 242.

[0102] Alternatively, the third filter module 25 may also store a fourth signal identifier and a fifth signal identifier. The fourth signal identifier includes one or more signal identifiers that have debugging permissions for the first resource module 241, and the fifth signal identifier includes one or more signal identifiers that have debugging permissions for the second resource module 242. Thus, if the third filter module 25 stores a signal identifier in the fourth signal identifier that is identical to the first signal identifier, but does not store a signal identifier in the fifth signal identifier that is identical to the first signal identifier, it can determine that the first device has debugging permissions for the first resource module 241 but does not have debugging permissions for the second resource module 242.

[0103] Furthermore, after determining that the first device has debugging permission for the first resource module 241 but not for the second resource module 242, the third filter module 25 allows the first device to debug the first resource module 241 and refuses to debug the second resource module 242. For example, the third filter module 25 can transmit the debugging data of the first device sent from the debugging port 22 to the first resource module 241 via the bus 23 connected to the first resource module 241, or it can transmit the data sent from the first resource module 241 to the third filter module 25 via the bus 23 to the debugging port 22, thereby realizing data transmission between the debugging port 22 and the first resource module 241. Additionally, the third filter module 25 can prevent the debugging data of the first device sent from the debugging port 22 from being transmitted to the bus 23 connected to the second resource module 242, so that the debugging data of the first device cannot be transmitted to the second resource module 242 via the bus 23 connected to the second resource module 242, thereby intercepting the data transmission between the debugging port 22 and the second resource module 242.

[0104] Thus, by means of the above method, when the chip 20 determines that the first device has the debugging permission to debug the first resource module 241 and does not have the debugging permission to debug the second resource module 242, the chip 20 can allow the first device to debug the first resource module 241 and refuse the first device to debug the second resource module 242.

[0105] Furthermore, in some other embodiments, since the central processing unit (CPU) is a core component of the chip, a separate filter module can also be provided for the CPU. For example, Figure 5 A schematic diagram of the structure of a chip 30 is shown, wherein, with Figure 4 Compared to chip 20, chip 30 has a separate fifth filter module 352 for the central processing unit 341.

[0106] refer to Figure 5As shown, chip 30 may include a secure debugging root of trust module 31, a debug port 32, and a bus 33. Furthermore, chip 30 may also include M resource modules, such as a central processing unit 341 (as an example of a first resource module) and a second resource module 342 (e.g., a controller). Chip 30 may also include a fourth filter module 351 and a fifth filter module 352. The bus 33 may be a bus matrix comprising multiple buses. The fourth filter module 351 is connected to M-1 resource modules (excluding the central processing unit 341) via the bus 33. The fourth filter module 351 is also connected to the debug port 32, and the fifth filter module 352 is connected between the debug port 32 and the central processing unit 341.

[0107] Understandable. Figure 5 The connection method of the modules inside the chip 30 shown is only one example. In other embodiments, the modules inside the chip can be directly connected through buses, signal lines or connectors, or they can be indirectly connected.

[0108] It is also understood that in some other embodiments, the central processing unit 341 may also be connected to the bus 33 in order to communicate with other modules in the chip 30 via the bus 33.

[0109] like Figure 5 As shown, the secure debugging trust root module 31 in chip 30 can receive a first chip debugging request from a first device and perform security authentication on the first device. Then, if the first device is successfully authenticated, the secure debugging trust root module 31 can open the debugging port 32. Furthermore, if the first device is successfully authenticated, the secure debugging trust root module 31 can also determine the first user identifier that initiated the first chip debugging request through the first device based on the first qualification certificate and the first correspondence used during the authentication process. Subsequently, after determining the first user identifier, the secure debugging trust root module 31 can send a first signal identifier indicating the first user identifier to the fourth filter module 351 and the fifth filter module 352, respectively. For example, the secure debugging trust root module 31 can transmit the first signal identifier to the fourth filter module 351 and the fifth filter module 352 via the debugging port 32. See details for further information. Figure 3 As previously stated, I will not repeat myself.

[0110] For example, such as Figure 5 As shown, when the fourth filter module 351 receives the first signal identifier, the fourth filter module 351 can determine the resource modules that the first device can debug, excluding the central processing unit 341, based on the first signal identifier, and then only transmit the debugging data of the first device to the resource modules that can be debugged.

[0111] For example, the fourth filter module 351 can determine that the first device does not have debugging permission to debug the second resource module 342 based on the first signal identifier. For example, the fourth filter module 351 can store a third correspondence, which may include a correspondence between multiple signal identifiers and multiple module identifier groups (e.g., other than the central processing unit 341). Each module identifier group includes the module identifier of at least one resource module for which the corresponding signal identifier has debugging permission. The multiple signal identifiers in the third correspondence include the first signal identifier, and the multiple module identifier groups in the third correspondence include a second module identifier group corresponding to the first signal identifier (e.g., other than the central processing unit 341). Then, if the second module identifier group corresponding to the first signal identifier in the third correspondence does not include the module identifier of the second resource module 342, the fourth filter module 351 can determine that the first device does not have debugging permission to debug the second resource module 342.

[0112] For example, the fourth filter module 351 may also store a sixth signal identifier, which includes one or more signal identifiers that have debugging permissions for the second resource module 342. Thus, if the fourth filter module 351 does not have a signal identifier in its sixth signal identifier that is identical to the first signal identifier, it can be determined that the first device does not have debugging permissions for the second resource module 342.

[0113] Furthermore, after determining that the first device does not have debugging permission to debug the second resource module 342, the fourth filter module 351 can refuse the first device's debugging of the second resource module 342. For example, the fourth filter module 351 can prevent the debugging data of the first device sent through the debugging port 32 from being transmitted to the bus 33 connected to the second resource module 342, so that the debugging data of the first device cannot be transmitted to the second resource module 342 via the bus 33 connected to the second resource module 342, thereby intercepting the data transmission between the debugging port 32 and the second resource module 342.

[0114] Thus, by using the above method, when the chip 30 determines that the first device does not have the debugging permission to debug the second resource module 342, the chip 30 can refuse the first device from debugging the second resource module 342.

[0115] In other embodiments, reference continues. Figure 5 As shown, when the fifth filter module 352 receives the first signal identifier from the secure debugging trust root module 31, the fifth filter module 352 can determine that the first device has debugging permission to debug the central processing unit 341 based on the first signal identifier, and thus allow the first device to debug the central processing unit 341.

[0116] For example, the fifth filter module 352 can store a seventh signal identifier, which may include one or more signal identifiers (such as stored signal identifiers 01, 11, etc.) that have debugging permissions for the central processing unit 341. Thus, when the fifth filter module 352 determines that there is a signal identifier in the stored seventh signal identifiers that is identical to the first signal identifier (such as signal identifier 11), the fifth filter module 352 can determine that the first device has debugging permissions for the central processing unit 341, thereby allowing the first device to debug the central processing unit 341. For example, the fifth filter module 352 can transmit the debugging data of the first device to the central processing unit 341 or transmit the data of the central processing unit 341 to the debugging port 32, thereby enabling the fifth filter module 352 to act as a communication path between the debugging port 32 and the central processing unit 341.

[0117] Thus, by using the above method, chip 30 can also determine whether the first device has debugging permission to debug the central processing unit 341, so as to refuse debugging operation on the central processing unit 341 if it does not have the permission to debug the central processing unit 341.

[0118] It should be noted that, in the embodiments of this application, the code existing in the secure debugging trust root module is public, mutually trusted, and tamper-proof to all manufacturers participating in chip debugging. For example, the hardware in the secure debugging trust root module can be ensured to be untamperable by the manufacturers participating in chip debugging through architecture design and code review, and the software can be ensured to be protected through secure boot and code review.

[0119] In summary, based on the above method, when a chip is jointly owned by multiple manufacturers, when an engineer from one manufacturer debugs the chip using the first device, the engineer can only access or modify the chip resources owned by their own manufacturer, and cannot obtain the chip resources unique to other manufacturers, which is beneficial for protecting the confidentiality of other manufacturers' chip resources.

[0120] Furthermore, in some embodiments, corresponding to the above-described secure debugging method, this application also provides a method such as... Figure 3 Chip 10 is shown.

[0121] For example, such as Figure 3As shown, chip 10 may include a secure debugging trust root module 11 and a bus 13. Chip 10 may also include M resource modules, such as a first resource module 141 and a second resource module 142, and R filter modules, such as a first filter module 151 and a second filter module 152. Each of the M resource modules is connected to one of the R filter modules via the bus 13. That is, a filter module can be connected to one or more resource modules.

[0122] For example, the first filter module 151 of the R filter modules is connected between the first resource module 141 and the bus 13, and the second filter module 152 of the R filter modules is connected between the second resource module 142 and the bus 13. Alternatively, in some other embodiments, the first filter module 151 may also be connected between the second resource module 142 and the bus 13 (this connection method is not shown in the figure), and this application does not limit this.

[0123] The secure debugging trust root module 11 is used to receive a first chip debugging request from a first device and perform security authentication on the first device. Furthermore, if the first device is successfully authenticated, the secure debugging trust root module 11 is also used to determine the first user identifier that initiated the first chip debugging request based on the first qualification certificate used for authentication and a first correspondence, and to send a first signal identifier indicating the first user identifier to R filter modules. The first correspondence includes a one-to-one correspondence between multiple qualification certificates and multiple user identifiers, where the multiple qualification certificates include a first qualification certificate, and the first user identifier is the user identifier among the multiple user identifiers that corresponds to the first qualification certificate.

[0124] A first filter module 151, connecting the first resource module 141 and the bus 13, is used to determine that the first device has debugging permission to debug the first resource module 141 if a signal identifier identical to the first signal identifier exists in the second signal identifiers stored in the first filter module 151. The second signal identifiers stored in the first filter module 151 include one or more signal identifiers that grant debugging permission to the first resource module 141. Furthermore, the first filter module 151 can also allow the first device to debug the first resource module 141.

[0125] The second filter module 152, connecting the second resource module 142 and the bus 13, is used to determine that the first device does not have debugging authority for the second resource module 142 if no signal identifier identical to the first signal identifier exists in the third signal identifier stored in the second filter module 152. The third signal identifier stored in the second filter module 152 includes one or more signal identifiers that have debugging authority for the second resource module 142. Furthermore, the second filter module 152 can also refuse the first device's attempt to debug the second resource module 142.

[0126] Alternatively, in some embodiments, if the second resource module 142 is connected to the bus 13 via a first filter module 151 (not shown in the diagram), the first filter module 151 is further configured to determine that the first device does not have debugging authority for the second resource module 142 if no signal identifier identical to the first signal identifier exists in the third signal identifier stored in the first filter module 151. The third signal identifier stored in the first filter module 151 includes one or more signal identifiers that have debugging authority for the second resource module 142. Furthermore, the first filter module 151 can also refuse the first device's debugging of the second resource module 142.

[0127] Thus, when the chip to be debugged is the aforementioned chip 10, if the chip 10 is jointly owned by multiple manufacturers and an engineer from one manufacturer debugs the chip 10 through the first device, the engineer can only access or modify the resources of the chip 10 owned by his own manufacturer, and cannot obtain the resources of the chip 10 unique to other manufacturers, which is beneficial to keeping the resources of the chip 10 of other manufacturers confidential.

[0128] In other embodiments, corresponding to the above-described secure debugging method, this application also provides another method such as... Figure 4 Chip 20 is shown.

[0129] For example, such as Figure 4 As shown, chip 20 may include a secure debugging root trust module 21, a debug port 22, and a bus 23. Furthermore, chip 20 may also include M resource modules, such as a first resource module 241 (e.g., a central processing unit) and a second resource module 242 (e.g., a controller). Additionally, chip 20 may include a third filter module 25, which may be connected between the debug port 22 and the bus 23.

[0130] The secure debugging trust root module 21 is used to receive a first chip debugging request from the first device and perform security authentication on the first device. Furthermore, if the first device is successfully authenticated, the secure debugging trust root module 21 is also used to determine the first user identifier that initiated the first chip debugging request based on the first qualification certificate used for authentication and a first correspondence, and send a first signal identifier indicating the first user identifier to the third filter module 25. The first correspondence includes a one-to-one correspondence between multiple qualification certificates and multiple user identifiers, where the multiple qualification certificates include the first qualification certificate, and the first user identifier is the user identifier among the multiple user identifiers that corresponds to the first qualification certificate.

[0131] The third filter module 25 is configured to determine, when the first module identifier group corresponding to the first signal identifier in the second correspondence relationship includes the module identifier of the first resource module 241 but does not include the module identifier of the second resource module 242, that the first device has debugging permission for debugging the first resource module 241 but does not have debugging permission for debugging the second resource module 242. The second correspondence relationship includes a correspondence between multiple signal identifiers and multiple module identifier groups. Each module identifier group includes the module identifier of at least one resource module for which the corresponding signal identifier has debugging permission. The multiple signal identifiers include the first signal identifier, and the first module identifier group is the module identifier group corresponding to the first signal identifier among the multiple module identifier groups. Furthermore, the third filter module 25 is also configured to allow the first device to debug the first resource module 241 but deny the first device from debugging the second resource module 242.

[0132] Alternatively, the third filter module 25 is further configured to determine that the first device has debugging permission for debugging the first resource module 241 but not debugging permission for debugging the second resource module 242, provided that a signal identifier identical to the first signal identifier exists in the fourth signal identifier and no signal identifier identical to the first signal identifier exists in the fifth signal identifier. Furthermore, the third filter module 25 is also configured to allow the first device to debug the first resource module 241 but deny the first device from debugging the second resource module 242. The fourth signal identifier includes one or more signal identifiers with debugging permission for the first resource module 241, and the fifth signal identifier includes one or more signal identifiers with debugging permission for the second resource module 242.

[0133] Thus, when the chip to be debugged is the aforementioned chip 20, chip 20 can allow the first device to debug the first resource module 241 that can be debugged and refuse the first device to debug the second resource module 242 that cannot be debugged.

[0134] In other embodiments, corresponding to the above-described secure debugging method, this application also provides another method such as... Figure 5 The chip 30 shown.

[0135] Figure 5 As shown, chip 30 may include a secure debugging root trust module 31, a debug port 32, and a bus 23. Furthermore, chip 30 may also include a central processing unit 341 and M resource modules, such as a second resource module 342 (e.g., a controller). Chip 10 may also include a fourth filter module 351 and a fifth filter module 352. The fourth filter module 351 is connected to M-1 resource modules (excluding the central processing unit 341) via the bus. The fourth filter module 351 is also connected to the debug port 32. The fifth filter module 352 is connected between the debug port 32 and the central processing unit 341.

[0136] The secure debugging trust root module 31 is used to receive a first chip debugging request from the first device and perform security authentication on the first device. Furthermore, if the first device is successfully authenticated, the secure debugging trust root module 31 is also used to determine the first user identifier initiating the first chip debugging request based on the first qualification certificate used for authentication and a first correspondence, and send a first signal identifier indicating the first user identifier to the fourth filter module 351 and the fifth filter module 352. The first correspondence includes a one-to-one correspondence between multiple qualification certificates and multiple user identifiers, where the multiple qualification certificates include the first qualification certificate, and the first user identifier is the user identifier among the multiple user identifiers that corresponds to the first qualification certificate.

[0137] The fourth filter module 351 is used to determine, by the first signal identifier, that the first device does not have the debugging permission to debug the second resource module 342, and to refuse the first device from debugging the second resource module 342.

[0138] The fifth filter module 352 is used to determine, based on the first signal identifier, that the first device has the debugging permission to debug the central processing unit 341, and to allow the first device to debug the central processing unit 341.

[0139] Thus, when the chip to be debugged is the aforementioned chip 30, if the chip 30 is jointly owned by multiple manufacturers and an engineer from one manufacturer debugs the chip 30 through the first device, the engineer can only access or modify the resources of the chip 30 owned by his own manufacturer, and cannot obtain the resources of the chip 30 unique to other manufacturers, which is beneficial to keeping the resources of the chip 30 of other manufacturers confidential.

[0140] Furthermore, in some embodiments, this application also provides an electronic device, which may include any of the chips mentioned above, such as chip 10, chip 20, or chip 30, etc.

[0141] Furthermore, in some embodiments, this application also provides a readable storage medium. The readable storage medium stores instructions that, when executed on a chip, cause the chip to perform the secure debugging method mentioned in this application.

[0142] Furthermore, in other embodiments, this application also provides a computer program product, wherein the computer program product includes computer instructions. When the computer instructions are executed on the chip, the chip enables the chip to implement the secure debugging method mentioned in this application.

[0143] Furthermore, in some embodiments, this application also provides an electronic device, which may include a chip capable of implementing the secure debugging method mentioned in this application through logic circuits or execution instructions.

[0144] For example, such as Figure 6 As shown, this application provides a schematic diagram of the structure of an electronic device. Figure 6 As shown, the electronic device 600 includes an SOC 601, a communication interface 602, a memory 603, and a communication bus 604.

[0145] The memory 603 stores a computer program that can run on the SOC 601. The memory 603 and the SOC 601 communicate through the communication interface 602 and the communication bus 604.

[0146] SOC601 can be any of the aforementioned chips, such as chip 10, chip 20, or chip 30. SOC601 may include a general-purpose processor, including a central processing unit, a neural network processor, etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0147] The memory 603 may include random access memory (RAM) or non-volatile memory, etc. Optionally, the memory 603 may also be at least one storage device located remotely from the SOC 601.

[0148] The communication bus 604 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. This communication bus 604 can be divided into an address bus, a data bus, a control bus, etc.

[0149] It should be noted that the connection method between units / modules in the accompanying drawings provided in this application is only one example. In other embodiments, units / modules can be directly connected via buses, signal lines, or connectors, or they can be indirectly connected.

[0150] Furthermore, some structural or methodological features may be shown in a specific arrangement and / or order in the accompanying drawings provided in this application. However, it should be understood that such a specific arrangement and / or order may not be necessary. For example, in other embodiments, these features may be arranged in a manner and / or order different from that shown in the illustrative drawings. Additionally, including structural or methodological features in a particular figure does not imply that such features are required in all embodiments; for example, in other embodiments, these features may be omitted or may be combined with other features.

[0151] It should be noted that all units / modules mentioned in the device embodiments of this application are logical units / modules. Physically, a logical unit / module can be a physical unit / module, a part of a physical unit / module, or a combination of multiple physical units / modules. The physical implementation of these logical units / modules themselves is not the most important factor; the combination of functions implemented by these logical units / modules is the key to solving the technical problems proposed in this application. Furthermore, to highlight the innovative aspects of this application, the above-described device embodiments of this application have not introduced units / modules that are not closely related to solving the technical problems proposed in this application. This does not mean that the above-described device embodiments do not contain other units / modules.

[0152] The embodiments disclosed in this application can be implemented in hardware, software, firmware, or a combination of these implementation methods. Embodiments of this application can be implemented as computer programs or program code executable on a programmable system, the programmable system including at least one processor, a storage system (including volatile and non-volatile memory and / or storage elements), at least one input device, and at least one output device.

[0153] In some cases, the disclosed embodiments may be implemented in hardware, firmware, software, or any combination thereof. The disclosed embodiments may also be implemented as instructions carried on or stored thereon by one or more transient or non-transitory machine-readable (e.g., computer-readable) storage media, which may be read and executed by one or more processors.

[0154] It should be noted that in the examples and description of this application, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one" does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0155] Although this application has been illustrated and described with reference to certain preferred embodiments thereof, those skilled in the art will understand that various changes in form and detail may be made thereto without departing from the scope of this application.

Claims

1. A safe debugging method, characterized in that, Applied to a chip, the chip including M resource modules, where M is an integer greater than 1, the method includes: A first chip debugging request was received from the first device; Authenticate the first device; If the first device is successfully authenticated, and based on the first qualification certificate used in the authentication, it is determined that the first device has debugging permissions for N resource modules out of the M resource modules, but does not have debugging permissions for MN resource modules other than the N resource modules out of the M resource modules, then the first device is allowed to debug the N resource modules, and the first device is denied from debugging the MN resource modules, where 1≤N<M and N is an integer.

2. The method according to claim 1, characterized in that, The determination, based on the first qualification certificate used for authentication, that the first device has debugging permissions for N resource modules out of the M resource modules, but does not have debugging permissions for MN resource modules other than the N resource modules, includes: Based on the first qualification certificate and the first correspondence, a first user identifier is determined to initiate the first chip debugging request. Based on the first user identifier, it is determined that the first device has debugging permissions for the N resource modules but not for the MN resource modules. The first correspondence relationship includes a one-to-one correspondence between multiple qualification certificates and multiple user identifiers. The multiple qualification certificates include the first qualification certificate, and the first user identifier is the user identifier among the multiple user identifiers that corresponds to the first qualification certificate.

3. The method according to claim 2, characterized in that, The chip includes a secure debug root trust module, a bus, and R filter modules, where R is a positive integer less than or equal to M. Each of the M resource modules is connected to one of the R filter modules via the bus. The first filter module among the R filter modules is connected between the first resource module among the N resource modules and the bus; the first filter module or the second filter module among the R filter modules is connected between the second resource module among the MN resource modules and the bus; and... Based on the first qualification certificate and the first correspondence, a first user identifier is determined to initiate the first chip debugging request, and based on the first user identifier, it is determined that the first device has debugging permissions for the N resource modules but not for the MN resource modules, including: The secure debugging trust root module determines the first user identifier based on the first qualification certificate and the first correspondence, and sends a first signal identifier indicating the first user identifier to the R filter modules; The first filter module, which connects the first resource module to the bus among the R filter modules, determines that the first device has debugging permission to debug the first resource module based on the first signal identifier, and allows the first device to debug the first resource module; The first filter module or the second filter module among the R filter modules that connects the second resource module to the bus determines, based on the first signal identifier, that the first device does not have debugging permission to debug the second resource module, and refuses the first device to debug the second resource module.

4. The method according to claim 3, characterized in that, The first filter module, which connects the first resource module to the bus among the R filter modules, determines that the first device has debugging permission to debug the first resource module based on the first signal identifier, including: If the first filter module finds a signal identifier in the second signal identifier stored in the first filter module that is identical to the first signal identifier, it determines that the first device has debugging permission to debug the first resource module, wherein the second signal identifier includes one or more signal identifiers that have debugging permission to the first resource module; The first filter module or the second filter module among the R filter modules that connects the second resource module to the bus, based on the first signal identifier, determines that the first device does not have debugging permission to debug the second resource module, including: If the first filter module or the second filter module determines that the first device does not have debugging permission to debug the second resource module if there is no signal identifier identical to the first signal identifier in the stored third signal identifier, wherein the third signal identifier includes one or more signal identifiers that have debugging permission to debug the second resource module.

5. The method according to claim 2, characterized in that, The chip includes a secure debug root trust module, a debug port, a bus, and a third filter module, wherein the third filter module is connected between the debug port and the bus; and, Based on the first qualification certificate and the first correspondence, a first user identifier is determined to initiate the first chip debugging request, and based on the first user identifier, it is determined that the first device has debugging permissions for the N resource modules but not for the MN resource modules, including: The secure debugging trust root module determines the first user identifier based on the first qualification certificate and the first correspondence, and sends a first signal identifier indicating the first user identifier to the third filter module; The third filter module determines, based on the first signal identifier, that the first device has the debugging permission to debug the first resource module among the N resource modules, but does not have the debugging permission to debug the second resource module among the N resource modules. It then allows the first device to debug the first resource module and refuses the first device to debug the second resource module.

6. The method according to claim 5, characterized in that, The third filter module determines, based on the first signal identifier, that the first device has debugging permission for the first resource module among the N resource modules, but does not have debugging permission for the second resource module among the N resource modules, including: In the second correspondence relationship, if the first module identifier group corresponding to the first signal identifier includes the module identifier of the first resource module but does not include the module identifier of the second resource module, the third filter module determines that the first device has the debugging permission to debug the first resource module but does not have the debugging permission to debug the second resource module. The second correspondence relationship includes a correspondence between multiple signal identifiers and multiple module identifier groups. Each module identifier group includes the module identifier of at least one resource module that has debugging permission for the corresponding signal identifier. The multiple signal identifiers include the first signal identifier. The first module identifier group is the module identifier group corresponding to the first signal identifier among the multiple module identifier groups. Alternatively, if the third filter module determines that the first device has the debugging permission to debug the first resource module but does not have the debugging permission to debug the second resource module when there is a signal identifier in the fourth signal identifier that is the same as the first signal identifier and there is no signal identifier in the fifth signal identifier that is the same as the first signal identifier, the third filter module determines that the first device has the debugging permission to debug the first resource module but does not have the debugging permission to debug the second resource module. The fourth signal identifier includes one or more signal identifiers that have the debugging permission to debug the first resource module, and the fifth signal identifier includes one or more signal identifiers that have the debugging permission to debug the second resource module.

7. The method according to claim 2, characterized in that, The M resource modules include a central processing unit (CPU). The chip includes a security debugging root trust module, a debug port, a bus, a fourth filter module, and a fifth filter module. The fourth filter module is connected to M-1 resource modules (excluding the CPU) among the M resource modules via the bus. The fourth filter module is also connected to the debug port. The fifth filter module is connected between the debug port and the CPU. Furthermore, when the first resource module among the N resource modules is the central processing unit, the step of determining the first user identifier that initiated the first chip debugging request based on the first qualification certificate and the first correspondence, and determining that the first device has debugging permissions for the N resource modules but not for the MN resource modules based on the first user identifier, includes: The secure debugging trust root module determines the first user identifier based on the first qualification certificate and the first correspondence, and sends a first signal identifier indicating the first user identifier to the fourth filter module and the fifth filter module; The fifth filter module determines that the first device has debugging permission to debug the first resource module based on the first signal identifier, and allows the first device to debug the first resource module; The fourth filter module determines, based on the first signal identifier, that the first device does not have debugging permission for the second resource module among the MN resource modules, and refuses the first device to debug the second resource module.

8. The method according to any one of claims 3 to 7, characterized in that, The chip includes a debug port; The step of allowing the first device to debug the first resource module includes: establishing a communication path between the debugging port of the chip and the first resource module, or allowing data transmission between the debugging port and the first resource module; The step of preventing the first device from debugging the second resource module includes: disconnecting the communication path between the debugging port of the chip and the second resource module, or intercepting the data transmission between the debugging port and the second resource module.

9. The method according to any one of claims 1 to 7, characterized in that, The M resource modules include one or more of the following resource modules: central processing unit, neural network processor, graphics processor, audio processor, microprocessor, memory, controller, baseband processor, sensor hub, tensor processing unit, and vision processing unit.

10. A chip, characterized in that, include: The system includes a secure debugging trust root module, M resource modules, R filter modules, and a bus. Each of the M resource modules is connected to one of the R filter modules via the bus. The first filter module among the R filter modules is connected between the first resource module among the M resource modules and the bus; the second filter module among the R filter modules is connected between the second resource module among the M resource modules and the bus; M is an integer greater than 1, and R is a positive integer less than or equal to M; where, The secure debugging trust root module is configured to receive a first chip debugging request from a first device and perform security authentication on the first device, and, if the first device is successfully authenticated, determine the first user identifier that initiated the first chip debugging request based on the first qualification certificate used for authentication and a first correspondence, and send a first signal identifier indicating the first user identifier to the R filter modules. The first correspondence includes a one-to-one correspondence between multiple qualification certificates and multiple user identifiers, the multiple qualification certificates include the first qualification certificate, and the first user identifier is the user identifier among the multiple user identifiers that corresponds to the first qualification certificate. The first filter module, which connects the first resource module and the bus among the R filter modules, is used to determine that the first device has debugging permission to debug the first resource module when there is a signal identifier identical to the first signal identifier in the second signal identifier stored in the first filter module, and to allow the first device to debug the first resource module, wherein the second signal identifier includes one or more signal identifiers that have debugging permission for the first resource module. The first filter module or the second filter module, which connects the second resource module to the bus among the R filter modules, is used to determine that the first device does not have debugging permission to debug the second resource module if there is no signal identifier identical to the first signal identifier in the third signal identifier stored in the first filter module or the second filter module, and to refuse the first device from debugging the second resource module. The third signal identifier includes one or more signal identifiers that have debugging permission for the second resource module.

11. A chip, characterized in that, include: The system includes a secure debugging trust root module, M resource modules, a debug port, a bus, and a third filter module. The third filter module is connected between the debug port and the bus. The M resource modules include a first resource module and a second resource module, where M is an integer greater than 1. The secure debugging trust root module is configured to receive a first chip debugging request from a first device and perform security authentication on the first device, and, if the first device is successfully authenticated, determine a first user identifier that initiated the first chip debugging request based on a first qualification certificate used for authentication and a first correspondence, and send a first signal identifier indicating the first user identifier to the third filter module. The first correspondence includes a one-to-one correspondence between multiple qualification certificates and multiple user identifiers, the multiple qualification certificates include the first qualification certificate, and the first user identifier is the user identifier among the multiple user identifiers that corresponds to the first qualification certificate. The third filter module is used to determine, in the case that the first module identifier group corresponding to the first signal identifier in the second correspondence relationship includes the module identifier of the first resource module but does not include the module identifier of the second resource module, that the first device has debugging permission to debug the first resource module but does not have debugging permission to debug the second resource module. Furthermore, the third filter module is also used to allow the first device to debug the first resource module and deny the first device from debugging the second resource module. The second correspondence relationship includes a correspondence between multiple signal identifiers and multiple module identifier groups. Each module identifier group includes the module identifier of at least one resource module for which the corresponding signal identifier has debugging permission. The multiple signal identifiers include the first signal identifier, and the first module identifier group is the module identifier group corresponding to the first signal identifier among the multiple module identifier groups. Alternatively, the third filter module is further configured to determine that the first device has debugging permission to debug the first resource module but does not have debugging permission to debug the second resource module if there is a signal identifier identical to the first signal identifier in the fourth signal identifier and no signal identifier identical to the first signal identifier in the fifth signal identifier. Furthermore, the third filter module is further configured to allow the first device to debug the first resource module and refuse the first device to debug the second resource module, wherein the fourth signal identifier includes one or more signal identifiers having debugging permission for the first resource module, and the fifth signal identifier includes one or more signal identifiers having debugging permission for the second resource module.

12. A chip, characterized in that, include: The system includes a secure debugging root trust module, M resource modules, a debug port, a bus, a fourth filter module, and a fifth filter module. The M resource modules include a central processing unit (CPU) and a second resource module. The fourth filter module is connected to M-1 resource modules (excluding the CPU) via the bus. The fourth filter module is also connected to the debug port. The fifth filter module is connected between the debug port and the CPU. M is an integer greater than 1. The secure debugging trust root module is configured to receive a first chip debugging request from a first device and perform security authentication on the first device, and, if the authentication of the first device is successful, determine a first user identifier that initiated the first chip debugging request based on a first qualification certificate used for authentication and a first correspondence, and send a first signal identifier indicating the first user identifier to the fourth filter module and the fifth filter module. The first correspondence includes a one-to-one correspondence between multiple qualification certificates and multiple user identifiers, the multiple qualification certificates include the first qualification certificate, and the first user identifier is the user identifier among the multiple user identifiers that corresponds to the first qualification certificate. The fourth filter module is used to determine, based on the first signal identifier, that the first device does not have the debugging permission to debug the second resource module, and to refuse the first device from debugging the second resource module; The fifth filter module is used to determine, based on the first signal identifier, that the first device has debugging permission to debug the central processing unit, and to allow the first device to debug the central processing unit.

13. An electronic device, characterized in that, Includes the chip as described in any one of claims 10 to 12.

14. An electronic device, characterized in that, Includes a chip, said chip being used to implement the method as described in any one of claims 1 to 9 via logic circuitry or execution instructions.

Images